vulnerability

Bilingual

Cisco FMC static credential vulnerability exploited as a zero-day
2 months ago
- Cisco Secure Firewall Management Center (FMC) has a static credential vulnerability (CVE-2026-XXXX) with a CVSS score of 5.3 (Medium) but rated High by Cisco due to potential privilege escalation.
- The vulnerability allows an unauthenticated, remote attacker to log in with a low-privileged account and access sensitive data.
- Cisco has released hotfixes for affected FMC versions (7.0, 7.2, 7.4, 7.6, 7.7, 10.0); no workarounds exist, and active exploitation has been reported since July 2026.
- Exploitation can be detected using the CLI command `cat /var/log/messages | grep license` for specific log entries.
- Cisco recommends rotating all credentials, keys, and certificates if exploitation is suspected, and upgrading to fixed software immediately.
"No way to prevent this" say users of only language where this regularly happens
2 months ago
- A critical vulnerability (CVE-2026-55200) in libssh2 causes heap corruption and remote code execution due to a missing upper bound check in the C code.
- The article satirically notes that such vulnerabilities occur only in C, which is responsible for 90% of memory safety vulnerabilities over the last 50 years.
- Programmers using C describe the situation as helpless, with no way to prevent these issues, echoing a common sentiment among the language's users.
Here’s how I got full admin rights in a Replit clone
2 months ago
- Spaces, a free Replit clone by Hack Club, had a vulnerability in its code execution mechanism.
- The code was run directly in the Spaces Python process with only import filtering, not proper sandboxing.
- The attacker exploited this to dump environment variables (GitHub, Slack secrets, Groq API key).
- Then escalated to full admin access by modifying session data.
- The vulnerability was responsibly disclosed and fixed within 9 days by moving to Piston (Docker/Isolate).
<antirez>
2 months ago
- Redis's security model is designed for trusted, sandboxed environments; exposing it to untrusted clients is insecure by design.
- Many Redis instances are unintentionally exposed to the internet due to lack of firewalling, authentication, or binding to localhost.
- A demonstration shows how an exposed Redis instance can be exploited to write arbitrary files, such as an SSH authorized_keys file, to gain remote access.
- The author argues that adding security features (like ACLs and AUTH) must balance usability for developers versus protection for inexperienced users.
- Proposed improvements include better default configurations (e.g., binding to 127.0.0.1 in redis.conf), requiring AUTH, and implementing user-based ACLs to restrict dangerous commands.
- ACLs can protect against both external attacks and internal errors by limiting what commands different users can execute, though they add complexity to replication and other systems.
Click to Pray, Click to Leak: The Pope's Official App Exposes 700K+ User Emails
2 months ago
- A security researcher discovered an IDOR (Insecure Direct Object Reference) vulnerability in the Click To Pray app, allowing unauthorized access to over 700,000 user accounts' personal information including email addresses, names, and birth dates.
- The vulnerability was reported on January 3, 2026, but received no response for six months, and the issue remained unaddressed until after media coverage from Dark Reading in July 2026.
- The API endpoint lacked authorization checks, and the signup process returned a validation hash, enabling immediate account verification without email access.
- The app's email authentication (SPF, DKIM, DMARC) was misconfigured, making legitimate emails indistinguishable from phishing attempts.
- The vulnerability was eventually fixed after media exposure, with the endpoint now only returning public profile data (names) and implementing proper authorization checks.
- The researcher received no acknowledgment or thanks from the organization, despite the fix being implemented silently.
Silent Replacement of Trusted macOS App Executables
2 months ago
- macOS allows silent replacement of a trusted app's main executable under /Contents/MacOS/ after archiving and restoring the app bundle, without triggering authorization prompts or security warnings.
- The attack requires only code execution as the current user, no elevated privileges, and works on apps downloaded from the web after their first launch.
- The replaced executable is ad hoc signed and can impersonate the trusted app in system permission prompts to request access to Keychain secrets and TCC-protected files.
- Apple declined to fix the issue, arguing that no Gatekeeper or TCC bypass occurred and that convincing users to approve prompts is social engineering.
- Suggested remediation includes revalidating code signatures when the bundle changes and displaying the developer identity in authorization prompts.
- The issue affects macOS Tahoe 26.0.0–26.5.2 and Golden Gate 27 beta 1–4, with earlier versions likely also affected.
Apple Fixes Hide My Email Vulnerability After 404 Media Coverage
2 months ago
- Apple fixed a vulnerability in its Hide My Email feature that allowed revealing users' real email addresses, after being aware of the issue for over a year.
- The fix was deployed on July 3, 2026, shortly after 404 Media reported the vulnerability, despite Apple knowing about it since June 2025.
- A class action lawsuit has been filed against Apple seeking refunds of subscription costs and an injunction over the company's handling of the vulnerability.
- The exploit worked by sending a targeted user a message that was rejected as spam, which leaked the real email address in email logs.
- Even after the fix, the risk may persist because past email logs could still contain leaked addresses, potentially affecting users who created Hide My Email addresses before July 7, 2026.
CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV
2 months ago
- Fortinet FortiSandbox contains an unauthenticated OS command injection vulnerability (CVE-2026-25089) in its web interface, rated CVSS 9.8, affecting versions 4.2.x, 4.4.0-4.4.8, 5.0.0-5.0.5, Cloud 5.0.4-5.0.5, and PaaS 5.0.4-5.0.5, with exploitation attempts observed since mid-June 2026.
- To find exposed FortiSandbox instances on a network, use methods such as port scanning (ports 443, 80, 22, 514), inspecting HTTP headers and TLS certificates for Fortinet identifiers, DNS queries for common naming patterns, and external data sources like SHODAN.
- Remediation includes patching to FortiSandbox 4.4.9+ or 5.0.6+, restricting management interface access from untrusted networks, auditing integrations with other Fortinet products, and conducting compromise hunting, while also addressing related exploited vulnerabilities CVE-2026-39808 and CVE-2026-39813.
UEFI shims undermining Secure Boot
2 months ago
- ESET identified 11 old UEFI shim bootloaders (version 0.9 and below) signed by Microsoft that can bypass UEFI Secure Boot on systems trusting Microsoft's third-party UEFI CA 2011 certificate.
- Exploitation allows attackers to execute untrusted code during boot, enabling deployment of bootkits like Bootkitty or BlackLotus, even on Secure Boot-enabled systems, without needing the affected software installed.
- Vulnerable shims were revoked in Microsoft's June 9th, 2026 Patch Tuesday update via dbx; Windows and Linux systems should update to block them.
- The attack surface extends to outdated second-stage bootloaders (e.g., GRUB 2) trusted by these shims, which may have known vulnerabilities like CVE-2015-5281, allowing Secure Boot bypass via unsigned code loading.
- Older shims lack modern security features like MOK denylist enforcement (introduced in shim 0.9) and SBAT enforcement (from version 15.3), ignoring revocations and policies.
- A shim vulnerability (CVE-2026-10797) in versions ≤0.9 allows bypassing certificate-based revocations by tampering with signature length fields in second-stage bootloaders.
- Microsoft's UEFI certificate expiration does not affect Secure Boot trust; revoked hashes are required to block vulnerable binaries, highlighting the need for better transparency in third-party UEFI signing.
Cursor 0day: When Full Disclosure Becomes the Only Protection Left
2 months ago
- Cursor IDE automatically executes a malicious git.exe from repository root without user interaction, leading to arbitrary code execution.
- Vulnerability identified December 2025, reported multiple times but remains unfixed after over 6 months and 197+ versions, with minimal vendor response.
- Mitigations include AppLocker policies for enterprises and using isolated environments for consumers until patched.
- Proof-of-concept demonstrated with Windows Calculator renamed to git.exe, showing repeated automatic execution.
- Lack of communication from Cursor raises concerns about security processes and accountability in AI-assisted development tools.
Guix substitute and guix pull vulnerabilities
3 months ago
- Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
- Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
- Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
- Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
- Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
- Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
- Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
- Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
- A test script is provided to check vulnerability status, with code included for validation.
Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses
3 months ago
- Apple's 'Hide My Email' tool has a vulnerability allowing discovery of hidden real email addresses.
- The vulnerability has remained unfixed for over a year, as confirmed by a security researcher and 404 Media's tests.
- Details are withheld because the issue is still exploitable as of the reporting date.
- The article is for paid members, offering unlimited ad-free access and bonus content, with free access available for this specific post.
Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
3 months ago
- Apple's Hide My Email service allows iCloud+ users to send and receive emails using random, unique addresses to keep their personal email private.
- Vulnerabilities discovered in Hide My Email enable attackers to uncover the hidden real email addresses behind these aliases.
- The issues were reported to Apple over a year ago, but as of June 30, 2026, they remain unfixed despite Apple claiming fixes on two occasions.
- Researchers realized the vulnerabilities' severity and scope are greater than initially thought, leading to public disclosure to inform users of the risk.
- A timeline details reporting and follow-ups from June 11, 2025, to June 30, 2026, with Apple acknowledging but not effectively resolving the vulnerabilities.
- To protect user privacy, exploit details will not be disclosed until fixes are implemented, but disabling new address creation and notifying users are suggested interim measures.
- The disclosure aims to allow users to account for risks when using Hide My Email and calls for Apple to collaborate openly to resolve the issues promptly.

vulnerability

Cisco FMC static credential vulnerability exploited as a zero-day

"No way to prevent this" say users of only language where this regularly happens

Here’s how I got full admin rights in a Replit clone

<antirez>

Click to Pray, Click to Leak: The Pope's Official App Exposes 700K+ User Emails

Silent Replacement of Trusted macOS App Executables

Apple Fixes Hide My Email Vulnerability After 404 Media Coverage

CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV

UEFI shims undermining Secure Boot

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

Guix substitute and guix pull vulnerabilities

Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses